A domain name feature-based shunting management system

Abstract

This invention discloses a domain name feature-based traffic control system. It obtains domain name feature fields from client-initiated request messages or server-side response messages, and performs blocking or traffic diversion processing based on these domain name features. The server-side response message can contain one or more domain names and IP addresses. IP addresses are associated with their corresponding domain names, with the number of associated IP entries reaching tens of millions. The IP addresses associated with the domain names also have the same blocking or traffic diversion functions as the domain names. The IP addresses refer to the destination IP extracted from network access request messages or the source IP extracted from response messages. When the IP in the message matches the associated IP, blocking or traffic diversion can be performed according to the domain name corresponding to that IP. This invention can efficiently and accurately block and divert traffic based on domain name features, and also supports blocking and diversion of tens of millions of IP entries.

Description

Technical Field

[0001] This invention relates to the field of Internet data flow analysis and application technology, specifically to a domain name feature-based traffic management system. Background Technology

[0002] A domain name feature-based traffic management system refers to the ability to control and process traffic based on the domain name characteristics of request or response messages. It can also control and distribute traffic based on the IP address corresponding to the domain name in the response message, thus facilitating the management of specific domain names and IP addresses. Current technologies for domain name feature-based traffic management or distribution only use a domain name processor to handle bidirectional traffic between the client and server. This approach, which tries to manage both domain name features and associated IP addresses, is inefficient, performs poorly, and is prone to errors, failing to meet the ever-increasing demands of network traffic and hindering the provision of better services. Therefore, there is an urgent need for a more efficient and convenient domain name feature-based traffic management system to effectively improve communication efficiency. Summary of the Invention

[0003] This invention provides a domain name feature-based traffic control system to solve the problems of low efficiency in blocking or traffic distribution when using a domain name processor alone. This reduces the number of processors, the overall power consumption of the system, and the hardware cost of the system.

[0004] The system includes a domain name rule management module, a domain name and IP address association module, a packet parsing and processing module, a traffic control module, a coprocessor, a domain name processor, memory 1, and memory 2. The specific process is as follows: The system extracts complete domain name features from client-initiated request messages or server-side response messages, and determines whether the obtained domain name features are in the pre-configured domain name rules. If they are in the pre-configured domain name rules, the system performs control or traffic diversion according to the actions configured in the domain name rules; otherwise, it performs other processing steps.

[0005] If the current message is a DNS server response message, the mapping between the domain name and IP address is further obtained, and the domain name and IP address are stored in the memory. If the domain name characteristics in the message are in the pre-set domain name rules, the IP address associated with the domain name needs to be sent to the coprocessor through the flow table, and subsequent IP packets are processed by the coprocessor.

[0006] Furthermore, this system extracts domain name characteristics from DNS messages and compares them with domain name rules, then performs traffic diversion or control according to the actions specified in the domain name rules. The methods include: The domain name characteristics of a domain name message are determined by the message parsing module of the domain name processor. This module first identifies messages whose source or destination port is 53, then further parses the domain name field within the message. Messages not originating from port 53 are not parsed further. If the destination port is 53, it is marked as a request message; if the source port is 53, it is marked as a response message. For response messages, the domain name-IP mapping relationship needs to be further parsed, and all domain name-IP associations are stored.

[0007] After extracting the domain characteristics from the domain message, it is necessary to use these characteristics to query a pre-set domain rule table. This pre-set domain rule table is created by loading domain rules into memory through a domain rule management module. These rules, loaded into memory, undergo a complex graph analysis and optimization process using specific patterns and syntax to generate a corresponding database. Furthermore, the generated database can be serialized and stored in memory for later use in the extraction process.

[0008] The extracted domain characteristics are searched in memory using the hyperscan method. If a rule is found, the action based on that rule is used to block or redirect traffic.

[0009] Furthermore, this system provides the ability to analyze the mapping between domain names and IP addresses, and to output or control the traffic of the server IPs corresponding to the DNS domain names specified by the rules. The method for real-time updating and maintaining the mapping between domain names and IP addresses is as follows: When the domain name processor resolves a message to a DNS server response and the message's domain name characteristics exist in pre-defined rules, it records the rule action and simultaneously generates a domain name-IP relationship table for all IPs associated with the domain name. This table is then sent to the coprocessor as a flow table. The coprocessor works in conjunction with the domain name processor. It handles incoming user packets, performs preprocessing, and then distributes them to the domain name processor for further resolution and processing. The coprocessor receives the flow table from the domain name processor and stores the domain name-IP address relationships in the table. The flow table entries are used to block or redirect incoming IP packets.

[0010] Compared with existing technologies, the significant advantages of the above-described technical solution of the present invention are as follows: 1. It effectively solves the problem of low efficiency in domain name blocking or traffic diversion when using a domain name processor alone.

[0011] 2. Using a coprocessor can reduce the number of domain name processors, lower hardware costs, and reduce device power consumption.

[0012] 3. Compared to using a domain name processor alone, it greatly improves processing power.

[0013] 4. Effectively improved the system's working efficiency. Attached Figure Description

[0014] The accompanying drawings are not intended to be drawn to scale. In the drawings, each identical or nearly identical component shown in the various figures may be denoted by the same reference numeral. For clarity, not every component is labeled in each figure. Embodiments of various aspects of the invention will now be described by way of example and with reference to the accompanying drawings, wherein: Figure 1 This is an overall flowchart of a domain name feature-based traffic management system according to the present invention.

[0015] Figure 2 This is a flowchart of a domain name processor based on a domain name feature-based traffic management system according to the present invention.

[0016] Figure 3 This is a flowchart of a coprocessor for a domain name feature-based traffic management system according to the present invention.

[0017] Figure 4 This is a module division diagram of a domain name feature-based traffic management system according to the present invention.

[0018] Figure 5 This is a system architecture diagram of a domain name feature-based traffic management system according to the present invention. Detailed Implementation

[0019] To better understand the technical content of the present invention, specific embodiments are described below in conjunction with the accompanying drawings.

[0020] This invention provides a domain name feature-based traffic management system for monitoring domain name traffic in a network. Figure 1 , Figure 2 , Figure 3 , Figure 4 and Figure 5 As shown, the system includes a domain name rule management module, a domain name and IP address association module, a packet parsing and processing module, a traffic control module, a coprocessor, a domain name processor, memory 1, and memory 2. The specific process is as follows: When the coprocessor detects a packet coming to port 53, it forwards the packet to the domain name processor for domain name feature resolution and processing.

[0021] After receiving a message from the coprocessor, the domain name processor first analyzes whether the message is a domain name message. If it is not a domain name message, the message is discarded. If it is a domain name message, the domain name characteristics are extracted, and the message processing module determines whether the obtained domain name characteristics are in the pre-configured domain name rules. If they are in the pre-configured domain name rules, the message is handed over to the traffic control module for management or traffic diversion according to the actions configured in the domain name rules.

[0022] The following steps should be taken before implementing control and triage: Step 1: The domain name processor needs to resolve whether the DNS message is a request message initiated by the client or a response message from the server. If the current message is a DNS server response message, it further obtains the mapping between the domain name and IP address, and stores the domain name and IP address in... Figure 5 In the memory 2, the memory 2 can be a memory, hard disk, USB flash drive or other storage device.

[0023] Step 2: The domain name rules are loaded into memory through the domain name rule management module. These rules, using specific patterns and special syntax, undergo a complex graph analysis and optimization process to generate a corresponding database. Furthermore, the generated database can be serialized and stored in memory for later retrieval during runtime.

[0024] Step 3: The message processing module searches for the relevant data in memory using the hyperscan method. Once found, the data is handed over to the traffic management module for processing. The traffic management module can handle messages that need to be traffic-splitting in four ways: outputting only all data packets sent by the client in the request direction, outputting only all data packets sent by the server in the return direction, outputting only a single data packet matching the rule, and outputting the complete data stream.

[0025] When the domain name processor detects that the server's response message is in the domain name rules, it will forward the mapping between the domain name and the IP address to the coprocessor in the form of a flow table. Figure 3 This is the coprocessor's processing flow. When the coprocessor detects a flow table, it will also store the flow table in a similar manner. Figure 5 The memory 1 shown can be a memory, hard disk, USB flash drive, or other storage device.

[0026] After the protocol processor obtains the mapping between domain names and IP addresses from the domain name processor, subsequent packets entering the coprocessor can be blocked or diverted based on the IP address in the packet to the server IP corresponding to the specified DNS domain name. The flow table issued by the domain name processor to the coprocessor contains diversion or control actions based on domain name characteristic rules. After the coprocessor extracts the IP address of the packet, it queries the flow table. If the IP address exists, it processes it according to the specified action.

[0027] Coprocessors typically use high-performance network processors or switching chips, while domain name processors can use smart network cards or high-performance CPUs.

[0028] Furthermore, the system's coprocessor and domain name processor work together. All external network packets are first analyzed by the coprocessor, and only DNS packets are forwarded to the domain name processor. This significantly reduces the processing load on the domain name processor and the number of domain name processors required. It effectively solves the problem of low efficiency in domain name blocking or traffic distribution when using a separate domain name processor.

[0029] Various aspects of the invention are described in this disclosure with reference to the accompanying drawings, in which numerous illustrative embodiments are shown. The embodiments of this disclosure are not necessarily defined to include all aspects of the invention. It should be understood that the various concepts and embodiments described above, as well as those described in more detail below, can be implemented in any of many ways, because the concepts and embodiments disclosed herein are not limited to any particular implementation. Furthermore, some aspects of the invention disclosed may be used alone or in any suitable combination with other aspects of the invention disclosed.

[0030] While the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the invention. Those skilled in the art can make various modifications and refinements without departing from the spirit and scope of the invention. Therefore, the scope of protection of the present invention shall be determined by the claims.

Claims

1. A domain name-based traffic diversion and control system, characterized in that, The system includes a domain name rule management module, a domain name and IP address association module, a message parsing and processing module, a traffic control module, a coprocessor, a domain name processor, memory 1, and memory 2. The domain name processor extracts the IP and domain name mapping from the DNS response message and sends it to the coprocessor. The coprocessor encapsulates or performs traffic control on the IP. The specific steps of the system are as follows: The first step is to extract complete domain name features from the request message initiated by the client or the response message from the server, and determine whether the obtained domain name features are in the pre-configured domain name rules. If they are in the pre-configured domain name rules, then control or traffic will be distributed according to the actions configured in the domain name rules. If the domain name is not in the pre-configured domain name rules, other processes are performed. If the current message is a DNS server response message, the mapping between the domain name and IP address is further obtained, and the domain name and IP address are stored in the memory. If the domain name characteristics in the message are in the pre-configured domain name rules, the IP address associated with the domain name needs to be sent to the coprocessor through the flow table, and subsequent IP packets are processed by the coprocessor. The second step involves extracting domain name features from the request messages sent by the client and the response messages from the DNS server. This includes first identifying messages with a source or destination port of 53 using the message parsing processing module, and then further parsing the domain name field in the message. Messages with ports other than 53 are not parsed further. If the destination port is 53, it is marked as a request message; if the source port is 53, it is marked as a response message. For response messages, it is necessary to further parse the domain name and IP mapping relationship in the message and store all the associations between domain names and IPs. The third step is to extract the domain name features from the message and check if they exist in the pre-set domain name rules; The fourth step is to finally use the coprocessor's flow table to block and de-flow IP packets; After the coprocessor receives the user packet, it performs a simple parsing. If it is a DNS packet, it forwards it to the domain name processor for domain name resolution. If it is a flow table packet, it stores the flow table entry in memory. If it is an IP packet, it extracts the source and destination IP addresses of the packet and queries the IP address flow table entry using the source or destination IP address. If the source or destination IP address is in the IP address table entry, it blocks or diverts the packet according to the action in the IP address table entry.

2. The domain name feature-based traffic management system according to claim 1, characterized in that, The pre-set domain name rules mentioned in the first step are loaded into memory by the domain name rule management module. These rules, loaded into memory, undergo a complex graph analysis and optimization process using specific patterns and syntax to generate a corresponding database. Furthermore, the generated database can be serialized and stored in memory for later retrieval. The extracted domain name features are then searched in memory using the hyperscan method. If a rule is found, the action based on that rule is used for blocking or traffic redirection.

3. The domain name feature-based traffic management system according to claim 1, characterized in that, In the third step, if the domain name characteristics of the DNS server response message exist in the pre-set rules, the rule action is recorded, and a domain name-IP relationship table is generated for all IPs associated with the domain name. This table is then sent to the coprocessor as a flow table. The coprocessor works in collaboration with the domain name processor. The coprocessor receives user packets, performs preprocessing, and then distributes them to the domain name processor for further resolution and processing. It receives the flow table sent by the domain name processor and stores the domain name-IP address relationship in the table. The function of the flow table entries is to block or divert the IP packets received by the user.

Images